No DKIM2 RFC exists yet, but three implementations already interoperate. The anatomy of DKIM2-Signature and Message-Instance, what has changed since the first drafts, and what you have to do today: almost nothing.
ARC (Authenticated Received Chain) lets every relay forward, sign, and seal the authentication results it observed so the final server can decide whether to trust the message.
